cleaning up permission logic